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DETAILED ACTION 



1. 



The response of 4/10/2006 was received and considered. 



2. 



Claims 1-2, 4-8, 10-16, 18-22, 24-30, 32-36 & 38-46 are pending. 



Response to Arguments 



3. Applicant's arguments filed 4/10/2006 have been fully considered but they are not 
persuasive. 

4. It is noted that Applicant's amendments to the claims are not in compliance with 37 CFR 
1.121(c). For example, the use of a single bracket set ([]) is not compliant with 37 CFR 
1.121(c)(2); rather a strike-through should be used or a double bracket ([[]]) may be used when 
deleting five or fewer characters or when a strike-through is not easily perceived . The response 
has been considered as a bona fide attempt, however, any further submissions not compliant with 
37 CFR 1.121(c) will be treated as such, according to MPEP §714. 

5. Applicant's response (p. 1 1) argues that "undesired" is described in the specification. 
However, this argument is moot, as applicant has removed this language from the claims. 

6. Applicant's response (pp. 11-12) argues that "non-virus" is to be read with regards to its 
plain and ordinary meaning, as evidenced by dictionary definitions. Applicant cites a definition 
from the American Heritage Dictionary of the English Language. Therefore, the term "virus" 
and as such it's opposite "non-virus" will be interpreted with regards to their plain and ordinary 
meaning. Applicant's definition is considered appropriate; as well, the Examiner cites Kephart's 
definition (col. 1, lines 17-21). Therefore, the rejections under 35 U.S.C. §1 12 are withdrawn. 

7. Applicant's response (p. 12) argues that "the Kephart reference teaches only the 
identification of virus signatures from a list or from files containing invariant viral code for the 
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purpose of future extraction (col. 5, lines 57-61)", but "applicant's logic differentiates between 
the identification of computer viruses and computer programs banned from use and performs the 
identification of the computer programs banned from use after the computer virus identification". 
However, since Kephart's invention identifies both virus and non-virus (programs banned from 
use), it is an inherent feature of the Kephart invention to identify a program banned from use 
after identifying a virus. Therefore, the rejection is maintained. 

8. Applicant's response (p. 13) also introduces new claims. Specifically, claim 43 recites 
(similar to claim 44) "wherein the at least one non-virus computer program includes at least one 
of a game or a data streaming program". However, Kephart discloses detecting and removing 
both virus and non-virus programs. Lavasoft (previously cited) teaches detecting and removing 
adware. The instantly cited patent to Fuller discloses that adware streams data. Therefore, it is 
submitted that the limitation regarding the non-virus programs including data streaming 
programs is an obvious variation over these references. Regarding claim 44, Kephart, as 
modified by Lavasoft and Fuller, lacks the non-virus programs including games. However, 
Brown teaches that it is known for an employer to prevent the addition of games onto an 
employee computer (col. 4, lines 10-12). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify Kephart such that the non- 
virus computer programs further include games. One of ordinary skill in the art would have been 
motivated to perform such a modification to enable employers to prevent the addition of the 
games to employee computers, as taught by Brown (col. 4, lines 10-12). 

9. Applicant's response (p. 13) introduces additional claim 45, reciting that the anti-virus 
logic of a plurality of end users each includes a different selected set of computer programs 
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banned from use. However, Kephart discloses the user is the entity supplying a file from which 
signatures are extracted (col. 5, lines 57-61). Therefore, it is an inherent feature of Kephart that 
each end user anti computer virus logic includes a different selected set of computer programs 
(user-selected signatures) banned from use. 

10. Applicant's response (p. 13) introduces an additional claim 46. Kephart lacks receiving a 
file access request and scanning the file, as claimed. However, Golds teaches that it is known to 
stack software modules as file system filter drivers that intercept file system-directed requests to 
a base file system for virus scanning fl[3 & T[8) and send a failed response/return if the operation 
is not passed (1(3 1). Therefore, it would have been obvious to one having ordinary skill in the art 
at the time the invention was made to modify Kephart to intercept a file access request and 
perform an anti-virus scan and return a fail response to an operating is the anti-virus scan is not 
passed to filter requests to a file system as is known in the art. Kephart is silent to the limitation 
that if said anti-virus scan is passed, a scan for the computer programs banned from use is 
performed. However, it is inherent in Kephart that all signatures will be scanned and therefore, 
if one signature does not match a file, the next will be checked. Therefore, since Kephart scans a 
file with respect to virus and non-virus files, it is inherent that when a virus signature does not 
match the file being scanned, the file will be scanned for the remaining signatures, at least one 
corresponding to a non-virus file. 

Claim Rejections - 35 USC§ 112 

1 1 . The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 
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12. Claim 44 is rejected under 35 U.S.C. 1 12 5 second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

a. Regarding claim 44, it is unclear how one program can include the plural "games" 
or "data streaming programs". For the purposes of this Office Action, the claim is 
understood to recite the following: "wherein a plurality of non-virus programs are 
specified to be banned from use and the plurality of non-virus programs include games 
and data streaming programs, " 

Claim Rejections - 35 USC §102 

13. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

14. Claims 1, 4, 7, 13, 15, 18, 21, 27, 29, 32, 35, 41 & 45 are rejected under 35 U.S.C. 102(b) 
as being anticipated by U.S. Patent 5,452,442 to Kephart. 

Regarding claims 1, 4, 7, 13, 15, 18, 21, 27, 29, 32, 35 & 41, Kephart discloses a user 
controlled program specifying logic (col. 5, lines 57-61) to specify said at least one computer 
program to be banned from use (col. 1, lines 35-49 & col. 5, lines 57-61), said at least one 
computer program comprising an undesired, non-virus computer program (col. 1, lines 15-34), 
and banned program identifying data generating logic responsive to said user controlled program 
specifying logic to generate banned program identifying data/signature (col. 5, lines 57-61) for at 
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least one computer program to be banned from use, said banned program identifying data being 
operable to control anti computer virus logic/scanner (col. 1, lines 35-49) to identify computer 
programs banned from use (col. 1, lines 35-49 & col. 2, lines 5-12). While Kephart is silent 
regarding the order of identifying computer viruses and programs banned from use, it is an 
inherent feature of Kephart' s invention that the anti computer virus logic will identify computer 
viruses prior to identifying the computer programs banned from use. 

Regarding claim 45, Kephart discloses the user supplying a file from which signatures are 
extracted (col. 5, lines 57-61). Therefore, it is an inherent feature of Kephart that each end user 
anti computer virus logic includes a different selected set of computer programs banned from 
use. 

Claim Rejections - 35 USC §103 

15. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

16. Claims 2, 8, 16, 22, 30 & 36 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 1, 7, 15, 21, 29 & 35 above, in further view of "Bad IDEA" 
by Peter Szor (Szor), in further view of "Cryptography in Everyday Life" by Sarah Simpson 
(Simpson). Kephart lacks encrypting the banned program identifying data/signatures with a 
private key. However, Szor teaches that to prevent modification of antivirus signature files, the 
files should be encrypted (p. 19, col. 2). Therefore, it would have been obvious to one having 
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ordinary skill in the art at the time the invention was made to modify Kephart to encrypt the 
banned program identifying data/signatures. One of ordinary skill in the art would have been 
motivated to perform such a modification to prevent modification of antivirus signature files, as 
taught by Szor (p. 19, col. 2). As modified, Symantec lacks using a private key. However, 
Simpson teaches that by encrypting a file with a private key, the sender of the encrypted file can 
be verified by decrypting it with the corresponding public key (p. 1, 1(1). Therefore, it would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
use a private key. One of ordinary skill in the art would have been motivated to perform such a 
modification to verify the creator of the signature files, as taught by Simpson (p. 1). 

17. Claims 5, 19 & 33, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart, as applied to claims 4, 18 & 32 above, in further view of "Heuristic Anti-Virus 
Technology" by Veldman. Kephart discloses detecting known viruses, but lacks the banned 
program identifying data including heuristic data identifying one or more behavioral 
characteristics. However, Veldman teaches that using heuristics and examining behaviors of a 
program allows detection of unknown viruses (§1 & §2.1). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to including in 
the identifying data, heuristic data identifying one or more behavioral characteristics. One of 
ordinary skill in the art would have been motivated to perform such a modification to detect 
unknown computer viruses, as taught by Veldman (§1, Tfl & §2.1). 



Application/Control Number: 09/809,073 Page 8 

Art Unit: 2134 

18. Claims 10, 24 & 38 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart, Szor and Simpson, as applied claims 8, 22 & 36 above, in further view of U.S. Patent 
5,844,986 to Davis. Kephart, as modified above, lacks storing the identifying data in a secure 
memory region. However, Davis teaches that to prevent a virus from corrupting a BIOS (secure 
flash memory), an authentication and validation procedure is required before the contents of the 
BIOS memory can be modified (col. 1, lines 32-45, lines 63-67 & col. 2, lines 1-7). Therefore, it 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to store the identifying data in a secure memory region (memory requiring authentication). 
One of ordinary skill in the art would have been motivated to perform such a modification to 
prevent a virus from corrupting the identifying data, as taught by Davis (col. 1, lines 32-45 & 63- 
67). 



19. Claims 1 1-12, 25-26 & 39-40 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 7, 21 & 35 above, in view of "Norton Antivirus User's 
Guide", by Symantec Corporation (Symantec). 

Regarding claims 1 1, 25 & 39, Kephart, as modified above, lacks explicitly triggering a 
banned program action. However, Symantec teaches that it is known to alert a user for a 
response (pp. 39-40). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to modify Kephart' s scanner to trigger a banned program 
action such as deleting the banned computer program (p. 40). One of ordinary skill in the art 
would have been motivated to perform such a modification to allow the user to rid the computer 
of the virus if the repair is not successful, as taught by Symantec (pp. 39-40). 
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Regarding claim 12, 26 & 40, Kephart, as modified above, lacks responding to an 
absence of said user generated banned program identifying data. However, Symantec teaches 
that it is important to have the most up-to-date virus signatures/banned program identifying data 
(p. 1 1) and that the signatures can be updated by restoring them from a remote source (p. 1 8). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart, as modified above, to respond to an absence of banned 
program identifying data by restoring the data from a remote source. One of ordinary skill in the 
art would have been motivated to perform such a modification to keep the system up-to-date, as 
taught by Symantec (pp. 11 & 18). 

20. Claims 6, 14, 20, 28, 34 & 42 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart, as applied to claims 1, 7, 15, 21, 29 & 35 above, in view of U.S. Patent 6,694,434 
to McGee et al. (McGee). Kephart lacks the banned program identifying data comprising data 
identifying permitted compute programs with all computer programs not matching a permitted 
computer program being identified as a computer program banned from use. However, McGee 
teaches that it would be desirable to control whether a calling application can execute on a 
processor, since unauthorized applications can be inadvertently downloaded onto a system (col. 
2, lines 35-41). McGee further discloses that each calling application's unique application 
verification data is generated upon it's calling and compared to a list of authorized programs 
(col. 3, line 64 - col. 4, line 4). Therefore, it would have been obvious to one having ordinary 
skill in the art at the time the invention was made to modify Kephart so that the banned program 
identifying data comprising data identifying permitted compute programs with all computer 
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programs not matching a permitted computer program being identified as a computer program 
banned from use. One of ordinary skill in the art would have been motivated to perform such a 
modification to protect a computer against inadvertently downloaded unauthorized programs, as 
taught by McGee (col. 2, lines 35-41 & col. 3, line 64 - col. 4, line 4). 

21 . Claim 43 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, as 
applied to claim 1, in view of "Ad-aware" by Lavasoft and U.S. Patent 6,216,1 12 to Fuller et al. 
(Fuller). Kephart lacks the non-virus computer program including at least one of a game and a 
data streaming program. However, Lavasoft teaches that it is known to detect and remove 
spyware and adware (p. 1) because spyware can, for example, change a user's system (p. 1). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart to include spyware/adware in the signatures, allowing the 
anti-virus logic to delete the adware/spyware. One of ordinary skill in the art would have been 
motivated to perform such a modification because detecting and removing adware and spyware 
is known in the art as beneficial, as taught by Lavasoft (p. 1). As modified, Kephart lacks 
explicitly a data streaming program. However, Fuller teaches that it is known in the art to install 
adware in a computer system, where the adware contacts servers and downloads new 
advertisements (streams data) (abstract). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to further modify Kephart to use the 
anti-virus software to remove data streaming programs. One of ordinary skill in the art would 
have been motivated to perform such a modification because adware streams data, as taught by 
Fuller (abstract). 
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22. Claim 44 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, 
Lavasoft, and Fuller, in further view of U.S. Patent 5,859,968 to Brown et al. (Brown). 
Regarding claim 44, Kephart, as modified above by Lavasoft and Fuller, lacks the non-virus 
programs further including games. However, Brown teaches that it is known for an employer to 
prevent the addition of games onto an employee computer (col. 4, lines 10-12). Therefore, it 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to modify Kephart such that the non- virus computer programs further include games. One 
of ordinary skill in the art would have been motivated to perform such a modification to enable 
employers to prevent the addition of the games to employee computers, as taught by Brown (col. 
4, lines 10-12). 

23. Claim 46 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart, as 
applied to claim 1 above, in further view of U.S. Patent Application Publication 2001/0020245 to 
Golds et al. (Golds). Kephart, as described above, lacks receiving a file access request and 
scanning the file. However, Golds teaches that it is known to stack software modules as file 
system filter drivers that intercept file system-directed requests to a base file system for virus 
scanning fl[3 & 1f8) and send a failed response/return if the operation is not passed (f3 1). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to modify Kephart to intercept a file access request and perform an anti- 
virus scan and return a fail response to an operating is the anti-virus scan is not passed. One of 
ordinary skill in the art would have been motivated to perform such a modification to filter 
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requests to a file system as is known in the art, as taught by Golds (ffl[3 & 8). As modified, 
Kephart is silent as to the limitation that if said anti-virus scan is passed, a scan for the computer 
programs banned from use is performed. However, it is inherent in Kephart that all signatures 
will be scanned and therefore, if one signature does not match a file, the next will be checked. 
Therefore, since Kephart scans a file with respect to virus and non-virus files, it is inherent that 
when a virus signature does not match the file being scanned, the file will be scanned for the 
remaining signatures, at least one corresponding to a non-virus file. 

Conclusion 

24. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

b. The '920 patent is cited for teaching identifying viruses before other non-virus 
data (cols. 4-5), but lacks motivation for doing so. 

c. The patent publication to Le-Rouzo is cited for teaching detecting non-virus 
programs, but does not constitute prior art. 

25. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
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the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

26. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841. 
The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. The 
examiner can also be reached on alternate Fridays from 6:45 a.m. - 3:15 p.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jacques Louis Jacques can be reached at (571) 272-6962. 

Any response to this action should be mailed to: 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 
Or faxed to: 

(571)273-8300 

(for formal communications intended for entry) 

Or: 

(571) 273-3841 (Examiner's fax, for informal or draft communications, please 
label "PROPOSED" or "DRAFT") 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (571) 272-2100. 

Information regarding the status of an application may be obtained from the Patent 

Application Information Retrieval (PAIR) system. Status information for published applications 

may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

applications is available through Private PAIR only. For more information about the PAIR 
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system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




